Security Onion full packet capture
Planning Suricata full packet capture in Security Onion 3: disk sizing for the retention you need, pivoting from alerts to PCAP, exporting streams to Wireshark, and capturing only where it pays off.
Security Onion features
Pages on Security Onion capabilities analysts use day to day: full packet capture, case management, file analysis with Strelka, and the Pro hardening features for regulated environments. Security Onion is source-available under the Elastic License 2.0, not OSI open source.
Security Onion Cases for incident investigation
Using Security Onion Cases as the analyst workflow: escalating from Alerts and Hunt, observables and analyzers, evidence attachments and history, and when a separate case management or SOAR tool is still needed.
Security Onion file analysis with Strelka and YARA
Extracting files from network traffic and scanning them with Strelka and YARA in Security Onion: which files are extracted, tuning YARA rules, deduplication, storage and the limits on encrypted traffic.
Security Onion Pro FIPS, STIG and encryption hardening
What Security Onion Pro adds for regulated and government networks: FIPS mode, OS STIG compliance, LUKS data-at-rest encryption and OIDC SSO, and how to decide whether the free edition is enough.
